Skip to content

chore(deps)(deps): bump the production-dependencies group across 1 directory with 46 updates#59

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-e55a74413e
Closed

chore(deps)(deps): bump the production-dependencies group across 1 directory with 46 updates#59
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-e55a74413e

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Bumps the production-dependencies group with 38 updates in the / directory:

Package From To
cosmiconfig 9.0.0 9.0.1
handlebars 4.7.8 4.7.9
@anthropic-ai/claude-code 2.1.50 2.1.104
@babel/runtime 7.28.6 7.29.2
@borewit/text-codec 0.2.1 0.2.2
@google/genai 1.42.0 1.49.0
@hono/node-server 1.19.9 1.19.14
@modelcontextprotocol/sdk 1.26.0 1.29.0
@supabase/supabase-js 2.97.0 2.103.0
fastmcp 3.33.0 3.35.0
axios 1.13.5 1.15.0
bare-fs 4.5.4 4.7.0
bare-os 3.6.2 3.8.7
bare-stream 2.8.0 2.13.0
bare-url 2.3.2 2.4.0
express-rate-limit 8.2.1 8.3.2
figlet 1.10.0 1.11.0
file-type 21.3.0 21.3.4
fs-extra 11.3.3 11.3.4
fuse.js 7.1.0 7.3.0
gaxios 7.1.3 7.1.4
google-auth-library 10.5.0 10.6.2
hono 4.12.1 4.12.12
koa 3.1.1 3.2.0
mcp-proxy 6.4.0 6.4.6
nan 2.25.0 2.26.2
node-abi 3.87.0 3.89.0
path-to-regexp 8.3.0 8.4.2
pump 3.0.3 3.0.4
qs 6.15.0 6.15.1
side-channel-list 1.0.0 1.0.1
sql.js 1.14.0 1.14.1
strtok3 10.3.4 10.3.5
undici 7.22.0 7.24.8
validator 13.15.26 13.15.35
ws 8.19.0 8.20.0
yaml 2.8.2 2.8.3
zod-to-json-schema 3.25.1 3.25.2

Updates cosmiconfig from 9.0.0 to 9.0.1

Changelog

Sourced from cosmiconfig's changelog.

9.0.1

  • Fixed a race condition where multiple instances existing simultaneously could cause cosmiconfig to fail to load TypeScript config files.
  • Fixed an issue on Windows where CWD being a short path (e.g. C:\Users\USERNA~1) would cause cosmiconfig to fail to load ESM config files.
Commits
  • 9a5cda3 9.0.1
  • 2174017 update changelog
  • 536d4a0 Prevent race conditions when running multiple instances of cosmiconfig and ...
  • 4b48611 remove debug log
  • 53d1745 remove more EOL node versions
  • 7c1a1e3 replace resolve with realpath
  • fcc9084 add additional path.resolve for windows short paths
  • 7e995c8 debug
  • 52b6b1c drop node 14 build as it seems to fail for unreachable reasons
  • db45e38 fix tests on windows (3)
  • Additional commits viewable in compare view

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

  • fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
  • fix type "RuntimeOptions" also accepting string partials - eab1d14
  • feat(types): set hash to be a Record<string, any> - de4414d
  • fix non-contiguous program indices - 4512766
  • refactor: rename i to startPartIndex - e497a35
  • security: fix security issues - 68d8df5

Commits

Commits
  • dce542c v4.7.9
  • 8a41389 Update release notes
  • 68d8df5 Fix security issues
  • b2a0831 Fix browser tests
  • 9f98c16 Fix release script
  • 45443b4 Revert "Improve partial indenting performance"
  • 8841a5f Fix CI errors with linting
  • e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
  • e914d60 Improve rendering performance
  • 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
  • Additional commits viewable in compare view

Updates @anthropic-ai/claude-code from 2.1.50 to 2.1.104

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.104

No release notes provided.

v2.1.101

What's changed

  • Added /team-onboarding command to generate a teammate ramp-up guide from your local Claude Code usage
  • Added OS CA certificate store trust by default, so enterprise TLS proxies work without extra setup (set CLAUDE_CODE_CERT_STORE=bundled to use only bundled CAs)
  • /ultraplan and other remote-session features now auto-create a default cloud environment instead of requiring web setup first
  • Improved brief mode to retry once when Claude responds with plain text instead of a structured message
  • Improved focus mode: Claude now writes more self-contained summaries since it knows you only see its final message
  • Improved tool-not-available errors to explain why and how to proceed when the model calls a tool that exists but isn't available in the current context
  • Improved rate-limit retry messages to show which limit was hit and when it resets instead of an opaque seconds countdown
  • Improved refusal error messages to include the API-provided explanation when available
  • Improved claude -p --resume <name> to accept session titles set via /rename or --name
  • Improved settings resilience: an unrecognized hook event name in settings.json no longer causes the entire file to be ignored
  • Improved plugin hooks from plugins force-enabled by managed settings to run when allowManagedHooksOnly is set
  • Improved /plugin and claude plugin update to show a warning when the marketplace could not be refreshed, instead of silently reporting a stale version
  • Improved plan mode to hide the "Refine with Ultraplan" option when the user's org or auth setup can't reach Claude Code on the web
  • Improved beta tracing to honor OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, and OTEL_LOG_TOOL_CONTENT; sensitive span attributes are no longer emitted unless opted in
  • Improved SDK query() to clean up subprocess and temp files when consumers break from for await or use await using
  • Fixed a command injection vulnerability in the POSIX which fallback used by LSP binary detection
  • Fixed a memory leak where long sessions retained dozens of historical copies of the message list in the virtual scroller
  • Fixed --resume/--continue losing conversation context on large sessions when the loader anchored on a dead-end branch instead of the live conversation
  • Fixed --resume chain recovery bridging into an unrelated subagent conversation when a subagent message landed near a main-chain write gap
  • Fixed a crash on --resume when a persisted Edit/Write tool result was missing its file_path
  • Fixed a hardcoded 5-minute request timeout that aborted slow backends (local LLMs, extended thinking, slow gateways) regardless of API_TIMEOUT_MS
  • Fixed permissions.deny rules not overriding a PreToolUse hook's permissionDecision: "ask" — previously the hook could downgrade a deny into a prompt
  • Fixed --setting-sources without user causing background cleanup to ignore cleanupPeriodDays and delete conversation history older than 30 days
  • Fixed Bedrock SigV4 authentication failing with 403 when ANTHROPIC_AUTH_TOKEN, apiKeyHelper, or ANTHROPIC_CUSTOM_HEADERS set an Authorization header
  • Fixed claude -w <name> failing with "already exists" after a previous session's worktree cleanup left a stale directory
  • Fixed subagents not inheriting MCP tools from dynamically-injected servers
  • Fixed sub-agents running in isolated worktrees being denied Read/Edit access to files inside their own worktree
  • Fixed sandboxed Bash commands failing with mktemp: No such file or directory after a fresh boot
  • Fixed claude mcp serve tool calls failing with "Tool execution failed" in MCP clients that validate outputSchema
  • Fixed RemoteTrigger tool's run action sending an empty body and being rejected by the server
  • Fixed several /resume picker issues: narrow default view hiding sessions from other projects, unreachable preview on Windows Terminal, incorrect cwd in worktrees, session-not-found errors not surfacing in stderr, terminal title not being set, and resume hint overlapping the prompt input
  • Fixed Grep tool ENOENT when the embedded ripgrep binary path becomes stale (VS Code extension auto-update, macOS App Translocation); now falls back to system rg and self-heals mid-session
  • Fixed /btw writing a copy of the entire conversation to disk on every use
  • Fixed /context Free space and Messages breakdown disagreeing with the header percentage
  • Fixed several plugin issues: slash commands resolving to the wrong plugin with duplicate name: frontmatter, /plugin update failing with ENAMETOOLONG, Discover showing already-installed plugins, directory-source plugins loading from a stale version cache, and skills not honoring context: fork and agent frontmatter fields
  • Fixed the /mcp menu offering OAuth-specific actions for MCP servers configured with headersHelper; Reconnect is now offered instead to re-invoke the helper script
  • Fixed ctrl+], ctrl+\, and ctrl+^ keybindings not firing in terminals that send raw C0 control bytes (Terminal.app, default iTerm2, xterm)
  • Fixed /login OAuth URL rendering with padding that prevented clean mouse selection
  • Fixed rendering issues: flicker in non-fullscreen mode when content above the visible area changed, terminal scrollback being wiped during long sessions in non-fullscreen mode, and mouse-scroll escape sequences occasionally leaking into the prompt as text
  • Fixed crash when settings.json env values are numbers instead of strings
  • Fixed in-app settings writes (e.g. /add-dir --remember, /config) not refreshing the in-memory snapshot, preventing removed directories from being revoked mid-session
  • Fixed custom keybindings (~/.claude/keybindings.json) not loading on Bedrock, Vertex, and other third-party providers
  • Fixed claude --continue -p not correctly continuing sessions created by -p or the SDK
  • Fixed several Remote Control issues: worktrees removed on session crash, connection failures not persisting in the transcript, spurious "Disconnected" indicator in brief mode for local sessions, and /remote-control failing over SSH when only CLAUDE_CODE_ORGANIZATION_UUID is set

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

Changelog

2.1.101

  • Added /team-onboarding command to generate a teammate ramp-up guide from your local Claude Code usage
  • Added OS CA certificate store trust by default, so enterprise TLS proxies work without extra setup (set CLAUDE_CODE_CERT_STORE=bundled to use only bundled CAs)
  • /ultraplan and other remote-session features now auto-create a default cloud environment instead of requiring web setup first
  • Improved brief mode to retry once when Claude responds with plain text instead of a structured message
  • Improved focus mode: Claude now writes more self-contained summaries since it knows you only see its final message
  • Improved tool-not-available errors to explain why and how to proceed when the model calls a tool that exists but isn't available in the current context
  • Improved rate-limit retry messages to show which limit was hit and when it resets instead of an opaque seconds countdown
  • Improved refusal error messages to include the API-provided explanation when available
  • Improved claude -p --resume <name> to accept session titles set via /rename or --name
  • Improved settings resilience: an unrecognized hook event name in settings.json no longer causes the entire file to be ignored
  • Improved plugin hooks from plugins force-enabled by managed settings to run when allowManagedHooksOnly is set
  • Improved /plugin and claude plugin update to show a warning when the marketplace could not be refreshed, instead of silently reporting a stale version
  • Improved plan mode to hide the "Refine with Ultraplan" option when the user's org or auth setup can't reach Claude Code on the web
  • Improved beta tracing to honor OTEL_LOG_USER_PROMPTS, OTEL_LOG_TOOL_DETAILS, and OTEL_LOG_TOOL_CONTENT; sensitive span attributes are no longer emitted unless opted in
  • Improved SDK query() to clean up subprocess and temp files when consumers break from for await or use await using
  • Fixed a command injection vulnerability in the POSIX which fallback used by LSP binary detection
  • Fixed a memory leak where long sessions retained dozens of historical copies of the message list in the virtual scroller
  • Fixed --resume/--continue losing conversation context on large sessions when the loader anchored on a dead-end branch instead of the live conversation
  • Fixed --resume chain recovery bridging into an unrelated subagent conversation when a subagent message landed near a main-chain write gap
  • Fixed a crash on --resume when a persisted Edit/Write tool result was missing its file_path
  • Fixed a hardcoded 5-minute request timeout that aborted slow backends (local LLMs, extended thinking, slow gateways) regardless of API_TIMEOUT_MS
  • Fixed permissions.deny rules not overriding a PreToolUse hook's permissionDecision: "ask" — previously the hook could downgrade a deny into a prompt
  • Fixed --setting-sources without user causing background cleanup to ignore cleanupPeriodDays and delete conversation history older than 30 days
  • Fixed Bedrock SigV4 authentication failing with 403 when ANTHROPIC_AUTH_TOKEN, apiKeyHelper, or ANTHROPIC_CUSTOM_HEADERS set an Authorization header
  • Fixed claude -w <name> failing with "already exists" after a previous session's worktree cleanup left a stale directory
  • Fixed subagents not inheriting MCP tools from dynamically-injected servers
  • Fixed sub-agents running in isolated worktrees being denied Read/Edit access to files inside their own worktree
  • Fixed sandboxed Bash commands failing with mktemp: No such file or directory after a fresh boot
  • Fixed claude mcp serve tool calls failing with "Tool execution failed" in MCP clients that validate outputSchema
  • Fixed RemoteTrigger tool's run action sending an empty body and being rejected by the server
  • Fixed several /resume picker issues: narrow default view hiding sessions from other projects, unreachable preview on Windows Terminal, incorrect cwd in worktrees, session-not-found errors not surfacing in stderr, terminal title not being set, and resume hint overlapping the prompt input
  • Fixed Grep tool ENOENT when the embedded ripgrep binary path becomes stale (VS Code extension auto-update, macOS App Translocation); now falls back to system rg and self-heals mid-session
  • Fixed /btw writing a copy of the entire conversation to disk on every use
  • Fixed /context Free space and Messages breakdown disagreeing with the header percentage
  • Fixed several plugin issues: slash commands resolving to the wrong plugin with duplicate name: frontmatter, /plugin update failing with ENAMETOOLONG, Discover showing already-installed plugins, directory-source plugins loading from a stale version cache, and skills not honoring context: fork and agent frontmatter fields
  • Fixed the /mcp menu offering OAuth-specific actions for MCP servers configured with headersHelper; Reconnect is now offered instead to re-invoke the helper script
  • Fixed ctrl+], ctrl+\, and ctrl+^ keybindings not firing in terminals that send raw C0 control bytes (Terminal.app, default iTerm2, xterm)
  • Fixed /login OAuth URL rendering with padding that prevented clean mouse selection
  • Fixed rendering issues: flicker in non-fullscreen mode when content above the visible area changed, terminal scrollback being wiped during long sessions in non-fullscreen mode, and mouse-scroll escape sequences occasionally leaking into the prompt as text
  • Fixed crash when settings.json env values are numbers instead of strings
  • Fixed in-app settings writes (e.g. /add-dir --remember, /config) not refreshing the in-memory snapshot, preventing removed directories from being revoked mid-session
  • Fixed custom keybindings (~/.claude/keybindings.json) not loading on Bedrock, Vertex, and other third-party providers
  • Fixed claude --continue -p not correctly continuing sessions created by -p or the SDK
  • Fixed several Remote Control issues: worktrees removed on session crash, connection failures not persisting in the transcript, spurious "Disconnected" indicator in brief mode for local sessions, and /remote-control failing over SSH when only CLAUDE_CODE_ORGANIZATION_UUID is set
  • Fixed /insights sometimes omitting the report file link from its response
  • [VSCode] Fixed the file attachment below the chat input not clearing when the last editor tab is closed

... (truncated)

Commits
  • 9772e13 chore: Update CHANGELOG.md
  • c5600e0 chore: Update CHANGELOG.md
  • d2b2252 Add MDM deployment example templates (#45866)
  • 3c72545 Merge pull request #45798 from anthropics/inigo/triage-prompt-accuracy
  • 54c7be5 Tighten invalid-label rule and require a category label on new issues
  • 22fdf68 chore: Update CHANGELOG.md
  • 227817d chore: Update CHANGELOG.md
  • b9fbc77 chore: Update CHANGELOG.md
  • b543a25 chore: Update CHANGELOG.md
  • 1e03cc7 chore: Update CHANGELOG.md
  • Additional commits viewable in compare view

Updates @babel/runtime from 7.28.6 to 7.29.2

Release notes

Sourced from @​babel/runtime's releases.

v7.29.2 (2026-03-16)

👓 Spec Compliance

  • babel-parser

🐛 Bug Fix

  • babel-helpers, babel-plugin-transform-async-generator-functions, babel-preset-env, babel-runtime-corejs3
  • babel-preset-env
    • #17789 [7.x backport] preset-env include/exclude should accept bugfix plugins (@​JLHwung)

🏠 Internal

Committers: 2

v7.29.1 (2026-02-04)

🐛 Bug Fix

Committers: 2

v7.29.0 (2026-01-31)

Thanks @​simbahax for your first PR!

🚀 New Feature

  • babel-types
  • babel-standalone

🐛 Bug Fix

  • babel-parser
  • babel-traverse
    • #17708 fix(traverse): provide a hub when traversing a File or Program and no parentPath is given (@​simbahax)
  • babel-plugin-transform-block-scoping, babel-traverse
    • #17737 [7.x backport] fix: Rename switch discriminant references when body creates shadowing variable (@​magic-akari)

... (truncated)

Commits

Updates @borewit/text-codec from 0.2.1 to 0.2.2

Release notes

Sourced from @​borewit/text-codec's releases.

v0.2.2

Changes

🐛 Bug Fixes

  • fix: improve encoding correctness and update README @​Borewit (#36)

NPM release

NPM release: @​borewit/text-codec@​0.2.2

Commits
  • c2ce9c5 0.2.2
  • e2f0705 Merge pull request #23 from Borewit/dependabot/npm_and_yarn/master/chai-6.2.2
  • 5e58cb8 Bump chai from 5.2.1 to 6.2.2
  • bc315b8 Merge pull request #37 from Borewit/update-biome
  • f32adfc Update biome to 2.4.6
  • 7776373 Merge pull request #36 from Borewit/fix-most-issue-exodus
  • 068d7d4 fix: improve encoding correctness and update README
  • See full diff in compare view

Updates @google/genai from 1.42.0 to 1.49.0

Release notes

Sourced from @​google/genai's releases.

v1.49.0

1.49.0 (2026-04-08)

Features

  • Introduce TYPE_L16 audio content and optional fields. (c62cb9a)

v1.48.0

1.48.0 (2026-03-31)

Features

  • Support dedicated TextAnnotationDelta for streaming tool responses (89552ba)

Bug Fixes

  • Fix service_tier enums. (9bdc2ae)

v1.47.0

1.47.0 (2026-03-27)

Features

  • Add custom_metadata to FileSearchResult. (083a1e3)
  • Add labels field to Veo configs (930c9c3)
  • Add mime type for Audio content (1ad80c6)
  • Add model_status to GenerateContentResponse (Gemini API only) (5e1110d)
  • Add part_metadata in Part (Gemini API only) (5e1110d)
  • Add service tier for interactions. (406de38)
  • Add service tier to GenerateContent. (0bfe800)
  • Add support for more image and audio MIME types in Interactions content (baadbfd)
  • Add supported models to the ModelOptions (94642b6)
  • genai: add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage (fdacac2)
  • support hyperparameters in distillation tuning (716e021)
  • Support rendered_parts in GroundingSupport (5e1110d)

Bug Fixes

  • support us region routing (d391cff)

v1.46.0

1.46.0 (2026-03-17)

Breaking changes

... (truncated)

Changelog

Sourced from @​google/genai's changelog.

1.49.0 (2026-04-08)

Features

  • Introduce TYPE_L16 audio content and optional fields. (c62cb9a)

1.48.0 (2026-03-31)

Features

  • Support dedicated TextAnnotationDelta for streaming tool responses (89552ba)

Bug Fixes

  • Fix service_tier enums. (9bdc2ae)

1.47.0 (2026-03-27)

Features

  • Add custom_metadata to FileSearchResult. (083a1e3)
  • Add labels field to Veo configs (930c9c3)
  • Add mime type for Audio content (1ad80c6)
  • Add model_status to GenerateContentResponse (Gemini API only) (5e1110d)
  • Add part_metadata in Part (Gemini API only) (5e1110d)
  • Add service tier for interactions. (406de38)
  • Add service tier to GenerateContent. (0bfe800)
  • Add support for more image and audio MIME types in Interactions content (baadbfd)
  • Add supported models to the ModelOptions (94642b6)
  • genai: add TURN_INCLUDES_AUDIO_ACTIVITY_AND_ALL_VIDEO to TurnCoverage (fdacac2)
  • support hyperparameters in distillation tuning (716e021)
  • Support rendered_parts in GroundingSupport (5e1110d)

Bug Fixes

  • support us region routing (d391cff)

1.46.0 (2026-03-17)

Breaking changes

  • [Interactions] Breaking change to Interactions API to refactor TextContent annotations to use specific citation types (9fa8b1d)
  • [Interactions] Breaking change for Interactions, rename ContentDelta unions. (917f24f)
  • [Interactions] Breaking change to Interactions API to rename rendered_content to search_suggestions (cc6bd38)

... (truncated)

Commits
  • 9deedb7 chore(main): release 1.49.0 (#1457)
  • c386d0c docs: Remove deprecated product recontext model samples from docstrings
  • 5ab2463 chore(interaction-api): Add Vertex AI Search and Enterprise Web Search to Int...
  • 227e509 chore: Remove/update tests for the deprecated product recontext model.
  • 850fbec chore: Remove constrain for Vertex AI in interactions.
  • c62cb9a feat: Introduce TYPE_L16 audio content and optional fields.
  • a5b2018 chore: Add missing modality types
  • 4b59428 chore: pull in change from custom code
  • 2b064e0 Copybara import of the project:
  • 14b6203 chore: internal change
  • Additional commits viewable in compare view

Updates @hono/node-server from 1.19.9 to 1.19.14

Release notes

Sourced from @​hono/node-server's releases.

v1.19.14

What's Changed

Full Changelog: honojs/node-server@v1.19.13...v1.19.14

v1.19.13

Security Fix

Fixed an issue in Serve Static Middleware where inconsistent handling of repeated slashes (//) between the router and static file resolution could allow middleware to be bypassed. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-92pp-h63x-v22m for details.

v1.19.12

What's Changed

Full Changelog: honojs/node-server@v1.19.11...v1.19.12

v1.19.11

What's Changed

Full Changelog: honojs/node-server@v1.19.10...v1.19.11

v1.19.10

Security Fix

Fixed an authorization bypass in Serve Static Middleware caused by inconsistent URL decoding (%2F handling) between the router and static file resolution. Users of Serve Static Middleware are encouraged to upgrade to this version.

See GHSA-wc8c-qw6v-h7f6 for details.

Commits

Updates @modelcontextprotocol/sdk from 1.26.0 to 1.29.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.29.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.28.0...v1.29.0

v1.28.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

What's Changed

... (truncated)

Commits

Updates @supabase/supabase-js from 2.97.0 to 2.103.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.103.0

2.103.0 (2026-04-09)

🚀 Features

  • postgrest: add stripNulls method for null value stripping (#2189)
  • storage: add cacheNonce parameter for download (#2234)

🩹 Fixes

  • postgrest: fix scalar computed column type inference for isNotNullable and SETOF scalar (#2224)

❤️ Thank You

v2.103.0-canary.2

2.103.0-canary.2 (2026-04-09)

🚀 Features

  • postgrest: add stripNulls method for null value stripping (#2189)
  • storage: add cacheNonce parameter for download (#2234)
  • supabase: export PostgrestFilterBuilder and StorageApiError from supabase-js (#2222)

🩹 Fixes

  • auth: downgrade console.error to console.warn for missing session (#2214)
  • functions: add toJSON to FunctionsError for correct JSON serialization (#2226)
  • postgrest: fix scalar computed column type inference for isNotNullable and SETOF scalar (#2224)
  • storage: set correct content-type for uploads (#2211)
  • storage: avoid duplicate content-type headers in vector requests (#2220)

❤️ Thank You

v2.103.0-canary.1

2.103.0-canary.1 (2026-04-09)

🚀 Features

  • storage: add cacheNonce parameter for download (#2234)
  • supabase: export PostgrestFilterBuilder and StorageApiError from supabase-js (

…rectory with 46 updates

Bumps the production-dependencies group with 38 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cosmiconfig](https://github.com/cosmiconfig/cosmiconfig) | `9.0.0` | `9.0.1` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.8` | `4.7.9` |
| [@anthropic-ai/claude-code](https://github.com/anthropics/claude-code) | `2.1.50` | `2.1.104` |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.28.6` | `7.29.2` |
| [@borewit/text-codec](https://github.com/Borewit/text-codec) | `0.2.1` | `0.2.2` |
| [@google/genai](https://github.com/googleapis/js-genai) | `1.42.0` | `1.49.0` |
| [@hono/node-server](https://github.com/honojs/node-server) | `1.19.9` | `1.19.14` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.26.0` | `1.29.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.97.0` | `2.103.0` |
| [fastmcp](https://github.com/punkpeye/fastmcp) | `3.33.0` | `3.35.0` |
| [axios](https://github.com/axios/axios) | `1.13.5` | `1.15.0` |
| [bare-fs](https://github.com/holepunchto/bare-fs) | `4.5.4` | `4.7.0` |
| [bare-os](https://github.com/holepunchto/bare-os) | `3.6.2` | `3.8.7` |
| [bare-stream](https://github.com/holepunchto/bare-stream) | `2.8.0` | `2.13.0` |
| [bare-url](https://github.com/holepunchto/bare-url) | `2.3.2` | `2.4.0` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.2.1` | `8.3.2` |
| [figlet](https://github.com/patorjk/figlet.js) | `1.10.0` | `1.11.0` |
| [file-type](https://github.com/sindresorhus/file-type) | `21.3.0` | `21.3.4` |
| [fs-extra](https://github.com/jprichardson/node-fs-extra) | `11.3.3` | `11.3.4` |
| [fuse.js](https://github.com/krisk/Fuse) | `7.1.0` | `7.3.0` |
| [gaxios](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/gaxios) | `7.1.3` | `7.1.4` |
| [google-auth-library](https://github.com/googleapis/google-cloud-node-core/tree/HEAD/packages/google-auth-library-nodejs) | `10.5.0` | `10.6.2` |
| [hono](https://github.com/honojs/hono) | `4.12.1` | `4.12.12` |
| [koa](https://github.com/koajs/koa) | `3.1.1` | `3.2.0` |
| [mcp-proxy](https://github.com/punkpeye/mcp-proxy) | `6.4.0` | `6.4.6` |
| [nan](https://github.com/nodejs/nan) | `2.25.0` | `2.26.2` |
| [node-abi](https://github.com/electron/node-abi) | `3.87.0` | `3.89.0` |
| [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `8.3.0` | `8.4.2` |
| [pump](https://github.com/mafintosh/pump) | `3.0.3` | `3.0.4` |
| [qs](https://github.com/ljharb/qs) | `6.15.0` | `6.15.1` |
| [side-channel-list](https://github.com/ljharb/side-channel-list) | `1.0.0` | `1.0.1` |
| [sql.js](https://github.com/sql-js/sql.js) | `1.14.0` | `1.14.1` |
| [strtok3](https://github.com/Borewit/strtok3) | `10.3.4` | `10.3.5` |
| [undici](https://github.com/nodejs/undici) | `7.22.0` | `7.24.8` |
| [validator](https://github.com/validatorjs/validator.js) | `13.15.26` | `13.15.35` |
| [ws](https://github.com/websockets/ws) | `8.19.0` | `8.20.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` |
| [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) | `3.25.1` | `3.25.2` |



Updates `cosmiconfig` from 9.0.0 to 9.0.1
- [Release notes](https://github.com/cosmiconfig/cosmiconfig/releases)
- [Changelog](https://github.com/cosmiconfig/cosmiconfig/blob/main/CHANGELOG.md)
- [Commits](cosmiconfig/cosmiconfig@v9.0.0...v9.0.1)

Updates `handlebars` from 4.7.8 to 4.7.9
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.9/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.8...v4.7.9)

Updates `@anthropic-ai/claude-code` from 2.1.50 to 2.1.104
- [Release notes](https://github.com/anthropics/claude-code/releases)
- [Changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-code@v2.1.50...v2.1.104)

Updates `@babel/runtime` from 7.28.6 to 7.29.2
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.2/packages/babel-runtime)

Updates `@borewit/text-codec` from 0.2.1 to 0.2.2
- [Release notes](https://github.com/Borewit/text-codec/releases)
- [Commits](Borewit/text-codec@v0.2.1...v0.2.2)

Updates `@google/genai` from 1.42.0 to 1.49.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v1.42.0...v1.49.0)

Updates `@hono/node-server` from 1.19.9 to 1.19.14
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v1.19.9...v1.19.14)

Updates `@modelcontextprotocol/sdk` from 1.26.0 to 1.29.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.26.0...v1.29.0)

Updates `@supabase/supabase-js` from 2.97.0 to 2.103.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.103.0/packages/core/supabase-js)

Updates `fastmcp` from 3.33.0 to 3.35.0
- [Release notes](https://github.com/punkpeye/fastmcp/releases)
- [Commits](punkpeye/fastmcp@v3.33.0...v3.35.0)

Updates `xsschema` from 0.4.0-beta.5 to 0.4.4
- [Release notes](https://github.com/moeru-ai/xsai/releases)
- [Commits](https://github.com/moeru-ai/xsai/commits/v0.4.4/packages-top/xsschema)

Updates `jose` from 5.10.0 to 6.1.3
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v5.10.0...v6.1.3)

Updates `axios` from 1.13.5 to 1.15.0
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.13.5...v1.15.0)

Updates `bare-fs` from 4.5.4 to 4.7.0
- [Release notes](https://github.com/holepunchto/bare-fs/releases)
- [Commits](holepunchto/bare-fs@v4.5.4...v4.7.0)

Updates `bare-os` from 3.6.2 to 3.8.7
- [Release notes](https://github.com/holepunchto/bare-os/releases)
- [Commits](holepunchto/bare-os@v3.6.2...v3.8.7)

Updates `bare-stream` from 2.8.0 to 2.13.0
- [Release notes](https://github.com/holepunchto/bare-stream/releases)
- [Commits](holepunchto/bare-stream@v2.8.0...v2.13.0)

Updates `bare-url` from 2.3.2 to 2.4.0
- [Commits](holepunchto/bare-url@v2.3.2...v2.4.0)

Updates `express-rate-limit` from 8.2.1 to 8.3.2
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](express-rate-limit/express-rate-limit@v8.2.1...v8.3.2)

Updates `figlet` from 1.10.0 to 1.11.0
- [Release notes](https://github.com/patorjk/figlet.js/releases)
- [Commits](patorjk/figlet.js@v1.10.0...v1.11.0)

Updates `file-type` from 21.3.0 to 21.3.4
- [Release notes](https://github.com/sindresorhus/file-type/releases)
- [Commits](sindresorhus/file-type@v21.3.0...v21.3.4)

Updates `fs-extra` from 11.3.3 to 11.3.4
- [Changelog](https://github.com/jprichardson/node-fs-extra/blob/master/CHANGELOG.md)
- [Commits](jprichardson/node-fs-extra@11.3.3...11.3.4)

Updates `fuse.js` from 7.1.0 to 7.3.0
- [Release notes](https://github.com/krisk/Fuse/releases)
- [Changelog](https://github.com/krisk/Fuse/blob/main/CHANGELOG.md)
- [Commits](krisk/Fuse@v7.1.0...v7.3.0)

Updates `gaxios` from 7.1.3 to 7.1.4
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/gaxios/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/gaxios-v7.1.4/packages/gaxios)

Updates `jackspeak` from 3.4.3 to 4.2.3
- [Changelog](https://github.com/isaacs/jackspeak/blob/main/changelog.md)
- [Commits](isaacs/jackspeak@v3.4.3...v4.2.3)

Updates `lru-cache` from 10.4.3 to 11.2.6
- [Changelog](https://github.com/isaacs/node-lru-cache/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-lru-cache@v10.4.3...v11.2.6)

Updates `path-scurry` from 1.11.1 to 2.0.2
- [Changelog](https://github.com/isaacs/path-scurry/blob/main/CHANGELOG.md)
- [Commits](isaacs/path-scurry@v1.11.1...v2.0.2)

Updates `google-auth-library` from 10.5.0 to 10.6.2
- [Release notes](https://github.com/googleapis/google-cloud-node-core/releases)
- [Changelog](https://github.com/googleapis/google-cloud-node-core/blob/main/packages/google-auth-library-nodejs/CHANGELOG.md)
- [Commits](https://github.com/googleapis/google-cloud-node-core/commits/google-auth-library-v10.6.2/packages/google-auth-library-nodejs)

Updates `hono` from 4.12.1 to 4.12.12
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.1...v4.12.12)

Updates `ip-address` from 10.0.1 to 10.1.0
- [Commits](https://github.com/beaugunderson/ip-address/commits)

Updates `koa` from 3.1.1 to 3.2.0
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v3.1.1...v3.2.0)

Updates `mcp-proxy` from 6.4.0 to 6.4.6
- [Release notes](https://github.com/punkpeye/mcp-proxy/releases)
- [Commits](punkpeye/mcp-proxy@v6.4.0...v6.4.6)

Updates `nan` from 2.25.0 to 2.26.2
- [Changelog](https://github.com/nodejs/nan/blob/main/CHANGELOG.md)
- [Commits](nodejs/nan@v2.25.0...v2.26.2)

Updates `node-abi` from 3.87.0 to 3.89.0
- [Release notes](https://github.com/electron/node-abi/releases)
- [Commits](electron/node-abi@v3.87.0...v3.89.0)

Updates `path-to-regexp` from 8.3.0 to 8.4.2
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v8.3.0...v8.4.2)

Updates `proxy-from-env` from 1.1.0 to 2.1.0
- [Release notes](https://github.com/Rob--W/proxy-from-env/releases)
- [Commits](Rob--W/proxy-from-env@v1.1.0...v2.1.0)

Updates `pump` from 3.0.3 to 3.0.4
- [Commits](mafintosh/pump@v3.0.3...v3.0.4)

Updates `qs` from 6.15.0 to 6.15.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.15.0...v6.15.1)

Updates `side-channel-list` from 1.0.0 to 1.0.1
- [Changelog](https://github.com/ljharb/side-channel-list/blob/main/CHANGELOG.md)
- [Commits](ljharb/side-channel-list@v1.0.0...v1.0.1)

Updates `sql.js` from 1.14.0 to 1.14.1
- [Release notes](https://github.com/sql-js/sql.js/releases)
- [Commits](sql-js/sql.js@v1.14.0...v1.14.1)

Updates `streamx` from 2.23.0 to 2.25.0
- [Commits](mafintosh/streamx@v2.23.0...v2.25.0)

Updates `strtok3` from 10.3.4 to 10.3.5
- [Release notes](https://github.com/Borewit/strtok3/releases)
- [Commits](Borewit/strtok3@v10.3.4...v10.3.5)

Updates `undici` from 7.22.0 to 7.24.8
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.22.0...v7.24.8)

Updates `validator` from 13.15.26 to 13.15.35
- [Release notes](https://github.com/validatorjs/validator.js/releases)
- [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md)
- [Commits](validatorjs/validator.js@13.15.26...13.15.35)

Updates `ws` from 8.19.0 to 8.20.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.19.0...8.20.0)

Updates `yaml` from 2.8.2 to 2.8.3
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

Updates `zod-to-json-schema` from 3.25.1 to 3.25.2
- [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases)
- [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md)
- [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits)

---
updated-dependencies:
- dependency-name: cosmiconfig
  dependency-version: 9.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: handlebars
  dependency-version: 4.7.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@anthropic-ai/claude-code"
  dependency-version: 2.1.104
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@babel/runtime"
  dependency-version: 7.29.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@borewit/text-codec"
  dependency-version: 0.2.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@google/genai"
  dependency-version: 1.49.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@hono/node-server"
  dependency-version: 1.19.14
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.29.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.103.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: fastmcp
  dependency-version: 3.35.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: xsschema
  dependency-version: 0.4.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jose
  dependency-version: 6.1.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-fs
  dependency-version: 4.7.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-os
  dependency-version: 3.8.7
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-stream
  dependency-version: 2.13.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: bare-url
  dependency-version: 2.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.3.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: figlet
  dependency-version: 1.11.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: file-type
  dependency-version: 21.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fs-extra
  dependency-version: 11.3.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: fuse.js
  dependency-version: 7.3.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gaxios
  dependency-version: 7.1.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jackspeak
  dependency-version: 4.2.3
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: lru-cache
  dependency-version: 11.2.6
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: path-scurry
  dependency-version: 2.0.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: google-auth-library
  dependency-version: 10.6.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hono
  dependency-version: 4.12.12
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ip-address
  dependency-version: 10.1.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: koa
  dependency-version: 3.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mcp-proxy
  dependency-version: 6.4.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: nan
  dependency-version: 2.26.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: node-abi
  dependency-version: 3.89.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: path-to-regexp
  dependency-version: 8.4.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: proxy-from-env
  dependency-version: 2.1.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pump
  dependency-version: 3.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: qs
  dependency-version: 6.15.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: side-channel-list
  dependency-version: 1.0.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sql.js
  dependency-version: 1.14.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: streamx
  dependency-version: 2.25.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: strtok3
  dependency-version: 10.3.5
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: undici
  dependency-version: 7.24.8
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: validator
  dependency-version: 13.15.35
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.20.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: zod-to-json-schema
  dependency-version: 3.25.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 13, 2026

Assignees

The following users could not be added as assignees: llm-dev-ops/maintainers. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link
Copy Markdown

🔒 Security Scan Results

Scan Type Status
Dependency Scan ⚠️ failure
CodeQL Analysis ✅ success
Secret Scan ✅ success
License Check ⚠️ failure
SAST ⚠️ failure

⚠️ Some security scans have warnings or failed. Please review the details.


Automated security scanning by GitHub Actions

@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 20, 2026

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Apr 20, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-e55a74413e branch April 20, 2026 10:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants